CVE-2026-74614 (GCVE-0-2026-74614)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
vsock/virtio: read virtqueues under worker locks
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: read virtqueues under worker locks
Commit bd50c5dc182b ("vsock/virtio: add support for device
suspend/resume") made the *_run flags transition from false to true when
restore installs replacement virtqueues. The RX, TX and event workers
read their virtqueue before locking and checking the corresponding flag,
so a worker delayed across freeze and restore can observe the replacement
queue's running state while retaining a pointer to the deleted queue.
Read each virtqueue under its mutex after checking the run flag, keeping
the pointer and state in the same queue generation.
Severity
8.4 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
762c251c7f5c4ee5bef71460c6e822ed293fd69f , < 941329ce14c5f481223a10d1d4c8b57ea7f3048a
(git)
Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < 29dd10583bf9d2744cd84b862e4257c0a5699570 (git) Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < a1fb0c5b8a7c2753758aeced40971f99449dde0c (git) Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < eae099c764c7ebdb842eb1f638913e310bdd6513 (git) Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < bd43a7ec668be428265b3209eb43647aedcf720a (git) Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < 1cecb4202afdbeddcf29d59baf596ac6ab753f7f (git) Affected: bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c , < ebac8f6b1ef0e9278afe204b8692a7479988dace (git) Affected: 5.15.138 , < 5.15.216 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a",
"status": "affected",
"version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f",
"versionType": "git"
},
{
"lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.138",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.138",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue\u0027s running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the guest virtio-vsock driver reached via AF_VSOCK sockets and virtio virtqueue completions, not via routable network protocols; per kernel CNA guidance vsock and virtio guest-driver bugs are scored Local even when the hypervisor is the peer.\nAC:L - An attacker or malicious host controls both sides of the race by flooding vsock/virtqueue traffic to queue RX/TX/event workers while virtio_vsock_freeze/restore deletes and replaces virtqueues, making the stale pre-lock virtqueue pointer race reliable and repeatable.\nPR:N - No guest privileges are required in the highest-impact scenario: a malicious hypervisor or host-initiated suspend/migrate triggers freeze/restore while virtio completions queue workers, matching confidential-computing models where the host is untrusted and holds no guest credentials.\nUI:N - Vulnerable RX/TX/event workers run automatically from virtqueue IRQ callbacks on a dedicated workqueue; no victim must mount filesystems, open files, or take deliberate action beyond normal virtio-vsock device operation and VM lifecycle events.\nS:U - Corruption is confined to the guest kernel virtio-vsock driver; exploited impact stays within the guest security boundary and does not cross to the hypervisor (guest-to-host escape would involve vhost-vsock on the host, not this guest-side driver).\nC:H - Use-after-free of a deleted virtqueue: virtqueue_disable_cb, virtqueue_get_buf, and virtqueue_enable_cb dereference freed vring_virtqueue slab memory, enabling attacker-controlled reuse and arbitrary kernel memory disclosure typical of virtio UAF bugs.\nI:H - Corrupted virtqueue metadata permits out-of-bounds ring/index manipulation and further virtqueue operations, furnishing heap corruption and arbitrary-write primitives suitable for guest ring-0 code execution and privilege escalation.\nA:H - Operating on freed virtqueues triggers KASAN slab-use-after-free and kernel BUG/oops/panic (as in the related virtio-vsock freeze bug CVE-2026-74613), fully denying guest availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:40.984Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"
},
{
"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"
},
{
"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"
},
{
"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"
},
{
"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"
},
{
"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"
},
{
"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"
}
],
"title": "vsock/virtio: read virtqueues under worker locks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74614",
"datePublished": "2026-08-22T15:31:59.800Z",
"dateReserved": "2026-08-15T05:44:03.920Z",
"dateUpdated": "2026-08-25T05:40:40.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74614",
"date": "2026-10-14",
"epss": "0.00142",
"percentile": "0.0309"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:10:00.000Z",
"cve": "CVE-2026-74614",
"id": "msrc_CVE-2026-74614",
"initial_release_date": "2026-08-24T01:08:15.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "vsock/virtio: read virtqueues under worker locks",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74614.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a",
"status": "affected",
"version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f",
"versionType": "git"
},
{
"lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace",
"status": "affected",
"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c",
"versionType": "git"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.138",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue\u0027s running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvsock/virtio: leer virtqueues bajo bloqueos de trabajador\n\nEl commit bd50c5dc182b (\u0027vsock/virtio: a\u00f1adir soporte para suspensi\u00f3n/reanudaci\u00f3n de dispositivo\u0027) hizo que las banderas *_run transicionaran de falso a verdadero cuando la restauraci\u00f3n instala virtqueues de reemplazo. Los trabajadores de RX, TX y eventos leen su virtqueue antes de bloquear y verificar la bandera correspondiente, por lo que un trabajador retrasado a trav\u00e9s de la congelaci\u00f3n y restauraci\u00f3n puede observar el estado de ejecuci\u00f3n de la cola de reemplazo mientras retiene un puntero a la cola eliminada.\n\nLeer cada virtqueue bajo su mutex despu\u00e9s de verificar la bandera de ejecuci\u00f3n, manteniendo el puntero y el estado en la misma generaci\u00f3n de cola."
}
],
"id": "CVE-2026-74614",
"lastModified": "2026-10-14T13:10:00.187",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-22T16:16:34.023",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-25T08:51:03+00:00",
"cve": "CVE-2026-74614",
"id": "CVE-2026-74614",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: vsock/virtio: read virtqueues under worker locks",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74614.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.